Skip to content

forwarding Source IP as client IP #2

@Rdago

Description

@Rdago

When using spoa on Haproxy the modproxy logs keep showing that the connected client is the haproxy itself (which in my case is 127.0.0.1, as I run the agent on the server in a docker) and modproxy logs this IP.

Is there a way to include the original source IP which connected to the HAproxy beforehand and pass it to modsecurity - in a forwarded for header for example?

The problem is that some features like geoip or ip reputation do not work on this scenario. Moreover when using siem-solution for logging the modsecurity logs and threats the connecting IP is always localhost.

Im looking forward to receive some tipps or even a solution how to handle this.

Thanks in advance.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions